Skip to content
Burrows Tools

HTML Entity Encoder and Decoder

Paste text and get it back with the characters that break HTML turned into entities — or paste entity-riddled markup and read it as plain text again. Encoding escapes the five characters a browser treats as markup, and can go further and write every character above ASCII as a numeric reference for pipelines that are not UTF-8 clean, either as numbers or as the spec's names. Decoding understands all 2,125 named references in the HTML standard, decimal and hexadecimal numbers, and the older names that browsers still accept without a semicolon, so a page that says … or — comes back reading the way it was written. Anything that only looks like an entity is left exactly as you typed it, because half the ampersands on the web are just ampersands. Emoji and other characters outside the basic plane survive the trip in one piece. It all happens in this tab: no upload, and no HTML parser is ever handed your text.

Encoded and decoded in this tab — nothing you paste is uploaded, and no HTML is ever parsed to do it.

Paste text or HTML — up to 200,000 characters.

How to use the html entity encoder and decoder

  1. Choose a direction: encode text into entities, or decode entities back into text.
  2. Paste or type into the first box — the result updates as you type.
  3. For encoding, pick whether to escape only the markup characters or everything above ASCII, and whether numbers or names are written.
  4. Copy the result, or press Swap to send it back as input and check it round-trips.
  5. Paste the encoded text straight into your HTML, template, or CMS field.

Frequently asked questions

Which characters actually have to be escaped?
Five: & < > " and '. The ampersand starts a reference and the angle brackets start a tag, so unescaped they change what the browser thinks your markup is; the quotes matter inside attribute values. Escaping only those five is the default here because it keeps the text readable. Everything else is optional and only worth doing when your file, database column, or email pipeline is not reliably UTF-8.
Why does the apostrophe come out as &#39; instead of &apos;?
Because &apos; was an XML name that HTML only adopted in HTML5. Older parsers, and a fair number of XML and email tools, leave it sitting on the page as literal text. The numeric form &#39; means the same character and has been understood everywhere since HTML 2.0, which is why escaping libraries emit it. Decoding accepts both.
Does it handle emoji and other characters outside the basic plane?
Yes, and it treats them as single characters rather than as the two surrogate halves JavaScript stores them in. An emoji encodes to one reference (&#128512; or &#x1F600;) and decodes back to exactly the same emoji, so text with emoji, flags, or family sequences round-trips unchanged. Numeric references that name half a surrogate pair are invalid HTML, and the decoder replaces them with U+FFFD the way a browser does.
What happens to something that is not really an entity?
It is left alone. "Fish & chips", a bare &, a truncated &#, an unknown &nosuchthing; — all copied through unchanged, and the status line tells you how many ampersands were left as written. Decoding has no failure mode other than pasting more than 200,000 characters at once, so it never mangles a page to punish one typo.
Is my text uploaded, and how is it decoded?
It is not uploaded — encoding and decoding are JavaScript in this tab, and the page keeps working offline once it has loaded. Decoding is a table lookup plus arithmetic against the WHATWG named character reference list. It deliberately does not use the common trick of assigning text to an element's innerHTML and reading it back, because that runs the HTML parser over whatever you pasted, which is a scripting hole rather than a shortcut.

Related tools